The Personal Information Protection Commission (PIPC) in South Korea has released a draft decree for public consultation, proposing changes to the Personal Information Protection Act (PIPA). The draft decree aims to enhance citizens' rights to control the processing of their personal data. It emphasizes the importance of obtaining freely given consent from data subjects and ensuring clear communication about their right to consent. The draft decree also seeks to establish a "technology-neutral" approach, unifying online and offline personal data processing regulations to align with the digital society.

Furthermore, the draft decree introduces criteria for assessing the severity of Personal Information Protection Act (PIPA) violations, including the nature and degree of the violation, the type of personal data affected, and the impact on the data subject. It also requires timely notification of data breaches to the PIPC and affected data subjects within 72 hours, regardless of the breach's scale.

Regarding cross-border data transfers, the PIPC will have the authority to issue stop orders to prevent or halt non-compliant transfers. The draft decree also imposes stricter data protection standards on the public sector, including personal data file registrations, impact assessments, and implementing safety measures.

Businesses processing personal data in South Korea will be affected by these proposed amendments and need to ensure compliance before the updated law takes effect. The public can provide comments and feedback on the draft decree until 28 June 2023.